The University of Agder (UiA) is the data controller for processing personal data that is registered and processed in connection with student and applicant relations at UiA.
This privacy statement provides information about how UiA processes personal data and what rights the data subject has.
What personal data has UiA registered?
Personal data is all information that can be linked to individuals.
The following personal data may be processed by UiA: Profile information (such as name, birth number/D number (11 digits), gender, contact information, background information, mother tongue, photo, video from camera surveillance), application information, consents given, status (such as residence permit and police certificate where relevant), semester registration information, invoice information and information relating to studies and courses.
As a general rule, no sensitive personal data is stored or processed. In exceptional cases, such information may be stored if it is necessary to make some adaptations to the study situation.
What UiA uses your personal data for
The most central purposes for which the personal data are used are stated below. The legal basis is either that
- the processing is authorized in §2-8 of the Universities and Colleges Act
- the processing is necessary in order to attend to the requisite interests of the student in the best possible way
- we have a legitimate interest in the processing that exceeds any privacy disadvantage for the student
- in certain cases we have also chosen to supplement the legal basis with declarations of consent
The purpose of the processing of personal data is to attend to your rights as an applicant, student, course participant or PhD candidate, and to fulfill the institution's tasks and duties according to the Universities and Colleges Act.
Processing of personal data is necessary for UiA to be able to
- process your application for admission to study programmes/examinations/courses
- undertake necessary administration in connection with your studies and you as a student
- document your educational results
Who does UiA share information with?
The issue or export of data is defined as every release of data other than to one's own system/ processes or to the registered individual themselves or someone who receives data on the behalf of said individual. UiA can issue or export data containing personal data to other systems, which means external data processors in those cases where it is considered necessary.
Your personal data can be issued to the following parties/organisations:
- Sikt– Norwegian Agency for Shared Services in Education and Research (service provider for Common Student System FS, Feide (a national solution for secure log-in and data sharing in education), library system, The Norwegian Research Information Repository, Student ID app and European Student Card.
- University of Oslo, (runs FS and service provider for user administration system and My Studies).
- Student Association Agder (SiA)
- Tietoevry (Folkeregisteret/ The National Register)
- The Norwegian State Educational Loan Fund
- Instructure (service provider for LMS)
- Inspera AS (service provider of digital examination system and plagiarism control system)
- UNIwise (service provider of digital examination system)
- Service Now (UiA’s service provider for the help-desk system)
- Unit4 (service provider for the accounting system)
- Other universities and university colleges
- NOKUT – the Norwegian Agency for Quality Assurance in Education
- Statistics Norway (SSB)
- NSD Norwegian Centre for Research Data
- Norwegian Directorate for Higher Education and Skills (the Database for Statistics on Higher Education (DBH))
- NIFU – Nordic Institute for Studies in Innovation, Research and Education
- The Norwegian Directorate of Health
- Watermark (service provider for the student evaluation system)
- Software Innovation AS (service provider for the case and archive system)
- The Student Organisation in Agder (STA)
- NOA A/S (provider of attendance registration system)
- MIRA (provider of Alumni system)
- Lovdata (provider of a collection of online legale resources)
- The National Archives of Norway
- Cooperative practice institutions
- Other parties who are legally entitled to access your personal data
Geographical storage of personal data
UiA ensures that personal data is stored in accordance with the privacy protection regulations for geographical storage. Any storage in third countries is done legally through the EU's approved transfer mechanisms. If you want specific information about where the individual personal data is stored, you can contact our data protection officer, see contact information listed under the point "Contact the Data Protection Office".
How long is personal data stored?
The personal data connected to admission and studies is not initially deleted in the UiA databases. There are some exceptions:
- Documents for applicants who apply through Norwegian Universities and Colleges Admission Service (NUCAS/SO), and who do not get a study place, are deleted when admission is completed.
- Personal data related to sanctions cf. §12-1 - §12-6 of the Universities and Colleges Act are automatically deleted from FS six months after the sanction period has expired.
- If UiA receives information about a death, contact information is deleted. Any applications for admission, registrations for teaching, courses and examinations etc. will be drawn.
- UiA stores information about which logins and actions are carried out in web applications, as well as IP addresses. This is to have documentation on registrations. The information is stored in FS and deleted after 12 months.
- Video from camera surveillance is automatically deleted after 7 days.
Your rights
The privacy protection regulations give you a number of rights related to your personal data:
- Even though this privacy statement provides a lot of information, you can request more detailed information about how we process information about you, and you have the right to access your personal data.
- If your personal data are incorrect, you have a right to see them corrected.
- Personal data that we may not have grounds for processing must be deleted, and you can demand this done if we have not arranged for it on our own initiative.
- You can request that we limit the use of your data.
- You have the right to what is known as data portability, and to request that your personal data be transferred to you, or to another organisation in a structural, universally applied and machine-readable format.
- You can oppose our use of your personal data. You can also oppose being subject to fully automated individual decisions of a legal nature.
- If you think that we process your personal data without a legal basis, you can complain to the Norwegian Data Protection Authority, but we do urge you to contact us, in part in order that we can review your objections, and in part so that we can clear up any possible misunderstandings.
The privacy protection regulations have extensive terms and conditions concerning the above, and exceptions from certain rights might apply. If you wish to make use of these
rights, contact us, and we will respond to your enquiry as quickly as possible, and normally within 30 days.
Contact the Data Protection Office
UiA has a data protection officer whose job it is to take care of the privacy protection interests of both students and staff at UiA. The data protection officer for administrative processing of personal data at UiA can be reached via:
- personvernombud@uia.no
- Address: Data Protection Officer (Personvernombud) at the University of Agder, Postboks 422, 4604 Kristiansand